chore: Enforce NPM v12 and disallow dependency install scripts (#493)

* Disable all install scripts in dependencies

* Enforce node version (lts) and npm version (latest)

* Use npm v12 (latest) across github workflows

Author: sjockers

.github/workflows/deploy-sophora-components.yml

@@ -25,6 +25,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
+      - run: npm install -g npm@12
       - name: Create .env file for production
         run: |
           touch .env

.github/workflows/deploy-storybook.yml

@@ -19,6 +19,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
+      - run: npm install -g npm@12
       - name: Create .env file for production
         run: |
           touch .env

.github/workflows/e2e.yml

@@ -22,6 +22,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.15.0
+      - run: npm install -g npm@12
       - run: npm ci --workspace=components --include=dev
       - run: npm run sync --workspace=components
       - run: npm ci --workspace=mock-sveltekit

.github/workflows/release.yml

@@ -35,6 +35,7 @@ jobs:
           node-version: 24
           registry-url: 'https://registry.npmjs.org/'
           package-manager-cache: false
+      - run: npm install -g npm@12
       - run: npm ci
       - run: npm audit signatures
       - name: Release

.github/workflows/test-storybook.yml

@@ -23,6 +23,7 @@ jobs:
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.15.0
+      - run: npm install -g npm@12
       - run: npm ci
       - run: npx playwright install --with-deps
       - run: npm run sync

.npmrc

@@ -1 +1,2 @@
-engine-strict=true
+engine-strict=true
+strict-allow-scripts=true

components/package.json

@@ -5,6 +5,10 @@
 	"author": "SWR Data Lab",
 	"license": "UNLICENSED",
 	"type": "module",
+	"engines": {
+		"node": "24.x",
+		"npm": "12.x"
+	},
 	"keywords": [
 		"svelte"
 	],

mock-sophora/package.json

@@ -3,6 +3,10 @@
   "version": "1.0.0",
   "description": "",
   "main": "index.js",
+  "engines": {
+    "node": "24.x",
+    "npm": "12.x"
+  },
   "scripts": {
     "build": "npx @11ty/eleventy",
     "start": "npx @11ty/eleventy --serve --quiet",

mock-sveltekit/package.json

@@ -3,6 +3,10 @@
 	"version": "0.0.1",
 	"private": true,
 	"type": "module",
+	"engines": {
+		"node": "24.x",
+		"npm": "12.x"
+	},
 	"scripts": {
 		"dev": "vite dev",
 		"start": "vite dev",

package.json

@@ -6,6 +6,10 @@
 	"scripts": {},
 	"author": "",
 	"license": "UNLICENSED",
+	"engines": {
+		"node": "24.x",
+		"npm": "12.x"
+	},
 	"workspaces": [
 		"components",
 		"sophora-components",
@@ -16,5 +20,16 @@
 		"svelte-select": {
 			"svelte-floating-ui": "1.5.9"
 		}
+	},
+	"allowScripts": {
+		"@swc/core@1.15.41": false,
+		"svelte-preprocess@6.0.3": false,
+		"fsevents@2.3.3": false,
+		"fsevents@2.3.2": false,
+		"@parcel/watcher@2.5.6": false,
+		"esbuild@0.28.1": false,
+		"puppeteer@22.15.0": false,
+		"sharp@0.34.5": false,
+		"unrs-resolver@1.12.2": false
 	}
 }